Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a821df3f authored by Ronnie Sahlberg's avatar Ronnie Sahlberg Committed by Steve French
Browse files

cifs: fix NULL deref in SMB2_read 



Signed-off-by: default avatarRonnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: default avatarPavel Shilovsky <pshilov@microsoft.com>
CC: Stable <stable@vger.kernel.org>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 328b4ed9

fs/cifs/smb2pdu.c

+15 −15
Original line number Original line Diff line number Diff line
@@ -2678,17 +2678,16 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 
	cifs_small_buf_release(req);

	cifs_small_buf_release(req);





	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;

	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;

	shdr = get_sync_hdr(rsp);



	if (shdr->Status == STATUS_END_OF_FILE) {

		free_rsp_buf(resp_buftype, rsp_iov.iov_base);

		return 0;

	}





	if (rc) {

	if (rc) {

		if (rc != -ENODATA) {

			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);

			cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);

			cifs_dbg(VFS, "Send error in read = %d\n", rc);

			cifs_dbg(VFS, "Send error in read = %d\n", rc);

	} else {

		}

		free_rsp_buf(resp_buftype, rsp_iov.iov_base);

		return rc == -ENODATA ? 0 : rc;

	}



	*nbytes = le32_to_cpu(rsp->DataLength);

	*nbytes = le32_to_cpu(rsp->DataLength);

	if ((*nbytes > CIFS_MAX_MSGSIZE) ||

	if ((*nbytes > CIFS_MAX_MSGSIZE) ||

	    (*nbytes > io_parms->length)) {

	    (*nbytes > io_parms->length)) {
@@ -2697,7 +2696,8 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 
		rc = -EIO;

		rc = -EIO;

		*nbytes = 0;

		*nbytes = 0;

	}

	}

	}



	shdr = get_sync_hdr(rsp);





	if (*buf) {

	if (*buf) {

		memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);

		memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);